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SECURE COMPUTATIONAL OUTSOURCING TECHNIQUES 



CROSS-REFERENCE TO RELATED APPLICATIONS 
The present application claims the benefit of commonly owned U.S. 
Provisional Patent Application Serial Number 60/085,515, filed l4 May 1998 which 
is hereby incorporated by reference in its entirety. 

BACKGROUND OF THE INVENTION 
The present invention relates to computer security techniques, and more 
particularly, but not exclusively, relates to techniques to provide more secure 
outsourcing of computations. 

Rapid growth in the area of computer technology, including networking 
schemes like the internet, has facilitated the transmission of data from a processing 
system at one site (the customer) to another site (the agent) to perform certain 
computations. Such "outsourcing" of certain computations may be desired, for 

• ! 

example, when the customer lacks the hardware resources, software resources, or 
other know-how to cost-effectively perform the computations. 

In one example, outsourcing is utilized in the financial services industry, 
where, for instance, the customer data includes projections of the likely future 
evolution of certain commodity prices, interest and inflation rates, economic statistics, 
portfolio holdings, etc. In another example, outsourcing is utilized in the energy 
services industry, where the proprietary data is typically seismic, and can be used to 
estimate the likelihood of finding oil or gas at a particular geographic spot in question. 
The seismic data may be so massive that the performance of corresponding matrix 
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multiplication and inversion computations would be beyond the resources of most 
major oil companies. Many other industries can also benefit fi-om outsourcing. 

With the advent of computational outsourcing, concerns regarding the agent's 
niisappropriation of customer data or the computational results have arisen. These 
concerns arise not only with the customer, but also with an agent .who wants to reduce 
the risk of misappropriation by its employees. One proposed scheme is to utilize 
standard cryptographic techniques to encrypt the data sent by the customer to the 
agent. While encryption may enhance security with respect to an attacking third 
party, it still requires that the agent have access to at least some of the cryptographic 
information, such as encryption/decryption keys, to perform a meaningful calculation. 
As a result, this scheme still provides the agent ready access to the actual data. 
Moreover, such schemes assume the agent will be a permanent repository of the data, 
performing certain operations on it and maintaining certain predicates. In many 
instances, this situation is also undesirable. Thus, there is a demand for techniques to 
improve the security of outsourced computations. 
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SUMMARY OF THE INVENTIONS 

One form of the present invention is a unique computational technique. 

A further form of the present invention is a unique systeni or method of 
disguising arguments to be submitted to a computation. 

Another form of the present invention is a unique system or method to 
perform a computation on disguised arguments and return a disguised result. 

Yet another form of the present invention is a computer readable medium that 
uniquely defines computer programming instructions to hide a group of actual 
arguments for a computation to be outsourced. 

Still another form of the present invention is a computer data transmission 
medium that includes a number of uniquely disguised arguments. These disguised 
arguments are sent via the medium to a site that performs an outsourced computation 
with the disguised arguments. 

■ t ... 

Th^ above-described forms of the present invention may be practiced in the 
alternative or in combination. Further, the above-described forms are merely 
illustrative and should not be considered restrictive or limiting, it being understood 
that other forms, features, aspects, objects, and embodiments of the present invention 
shall become apparent firom the drawings and description contained herein. 
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BRIEF DESCRIPTION OF THE DRAWINGS 



Fig. 1 is a diagrammatic view of one system according to the present 
invention. 

Fig. 2 is a flow chart of one process performed according to the present 
invention with the system of Fig. 1 . 

Fig. 3 is a block diagram of selected operational elements for disguising 
arguments according to the process of Fig. 2. 

Fig. 4 is a block diagram of selected operational elements for recovering 
actual answer from a disguised result according to the process of Fig. 2. 
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DESCRIPTION OF THE PREFERRED EMBODIMENTS 



For the purpose of promoting an understanding of the principles of the 
invention, reference will now be made to the embodiments illustrated in the drawings 
and specific language will be used to describe the same. It will nevertheless be 
understood that no limitation of the scope of the invention is thereby intended. Any 
alterations and further modifications in the described embodiments, and any fiirther 
applications of the principles of the invention as described herein are contemplated as 
would normally occur to one skilled in the art to which the invention relates. 

Fig. 1 illustrates system 20. System 20 includes data gathering and processing 
subsystem 30 and computing center 50. Subsystem 30 is alternatively depicted as 
customer C, and computing center 50 is alternatively depicted as agent A. Subsystem 
30 includes at least one computer 32. Computer 32 has memory 34, at least one input 
(I/P) device 36, and at least one output (O/P) device 38. Computing center 50 
includes at least one computer 52 with memory 54, at least one input (I/P) device 56, 
and at least 'one output (O/P) device 58. Memories 34, 54 each define at least one 
computer readable medium that is accessed by computers 32, 52, respectively. 

In one example, computers 32, 52 are of the programmable, digital variety 
and, memories 34, 54 are comprised of one or more components of the solid-state 
electronic type, electromagnetic type like a hard disk drive, optical type like a 
Compact Disk Read Only Memory (CD ROM), or a combination of these. In other 
embodiments, computer 32 or computer 52 and/or memory 34 or memory 54 may be 
otherwise configured as would occur to those skilled in the art. Typically, computers 
32, 52 will differ in some regard with respect to one another as more fully explained 
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hereinafter; however, other embodiments of the present invention may include 
computers 32, 52 that are substantially the same. 

Liput devices 36, 56 may include standard operator input devices such as a 
keyboard, mouse, digitizing pen, dedicated equipment for automatically inputting 
data, or such other devices as would occur to those skilled in the art. Output devices 

r 

38, 58 may include one or more displays, printers, or such other types as would occur 
to those skilled in the art. Fiirther, input devices 36, 56 or output devices 38, 58 may 
be in the form of components that perform both input and output operations such as 
one or more modems or other communication links. Such components may 
alternatively be considered a computer transmission medium to sending and receiving 
data. 

Fig. 1 depicts network 40 communicatively coupling subsystem 30 and 
computing center 50. Network 40 may be an internet connection or other form of 
network as would occur to those skilled in the art. Further, portable memory medium 
42 is shown as another means of exchanging data between subsystem 30 and 
computing center 50. Portable memory medium 42 may be in the form of one or 
more electromagnetic disks, tapes, or cartridges, optical disks, or such other form as 
would occur to those skilled in the art. It should be appreciated that network 40 and 
medium 42 may each be considered as being one of input devices 34, 54 and/or one of 
output devices 38, 58; and alternatively may each be regarded a type of data 
transmission medium for the transmission of computer data. 

Referring also to Fig. 2, outsourcing process 120 is illustrated. In stage 131 of 
process 120, subsystem 30 identifies and collects a group of actual arguments AA for 
a computation to be outsourced. As used herein, "argument" refers broadly to any 
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symbol, value, function, description, code, or other mathematical object that is input 
to a computation. 

Typically, subsystem 30 is not as desirable as computing center 50 for 
performance of the computation designated for outsourcing. This distinction may 
arise from one or more differences relating to hardware, software^ operator expertise, 
or available processing time. However, in other embodiments, the decision to 
outsource a particular computation may be independent of any such differences. 

k 

Once arguments are determined in stage 131, the outsourced mathematical 
computation is classified into one of a number of types in stage 133. A nonexclusive 
listing of computation types that may be good candidates for outsourcing is provided 
in table I as follows: 



No. 


Type 


1. 


Matrix Multiplication 


2i 


Matrix Inversion 


3. 


Solution of a Linear System of Equations 


4. 


Quadrature 


5. 


Convolution 


6. 


Numerical Solution of Differential Equations 


7. 


Optimization 


8. 


Solution of a Nonlinear System 


9. 


Image Edge Detection 


10. 


Image Template Matching 
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11. 


Sorting 


12. 


Character String Pattern Matching 



Table I 



It should be appreciated that the list of Table I is merely illustrative, and that other 
types of outsourced computations and classifications may be utilized in other 
embodiments. 

After classification, process 120 resumes with operation 220 to determine a set 
of disguised arguments DA based on the outsourced computation classification and 
the actual arguments AA. Disguised arguments DA are created in operation 220 to 
hide the nature of actual arguments AA fi-om the agent A selected to perform the 
outsourced computation, but at the same time permit recovery of a meaningfiil actual 
answer SA by customer C fi-om data provided by the computation. Several 
nonexclusive examples of the preparation of disguised arguments DA and recovery of 
actual answfer SA are provided hereinafter in connection with the description of Figs. 
3 and 4. 

Once disguised arguments DA are prepared, subsystem 30 (customer C) sends 
disguised arguments DA to computing center 50 (agent A) to perform the outsourced 
computation in stage 135. The transmission in stage 135 may also include 
instructions regarding the type of outsourced computation. Altematively, the nature 
of the computation may be established either before or after disguised arguments DA 
are sent. Disguised arguments DA and any instructions concerning the outsourced 
computation to be performed may be transmitted to computing center 50 via network 
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40, through portable computer readable medium 42, a combination of these, or 
through such other means as would occur to those skilled in the art. 

In stage 151, computing center 50 performs the designated computation with 
disguised arguments DA. For example, computer 52 may execute prograimning 
5 instructions stored in memory 54 to perform this computation. In* one example, 

computer 52 of computing center 50 is programmed to perform several different types 
of computations including one or more of those listed in Table I. Because disguised 
arguments DA are used, the result of the outsourced computation performed by 
computing center 50 typically differs from the actual answer SA that would have 

10 resulted if the outsourced computation had been performed with the actual arguments 
AA. The result for the computation performed with disguised arguments DA is then, 
in turn, hidden or disguised and is designated as disguised result DR. Computing 
center 50 sends disguised result DR back to subsystem 30 in stage 152. Subsystem 30 
receives disguised result DR in stage 161 and recovers the desired actual answer SA 

15 in operation 260. The recovery of actual answer SA is described in greater detail in 
connection with Figs. 3 and 4 and the examples that follow. 

It should be appreciated that disguised arguments DA and disguised result DR 
are the only information provided to computing center 50, such that the true nature of 
the data and answer for the selected outsourced computation are hidden through 

20 process 120. Consequently, a measure of security is provided by outsourcing process 
120 relative to simply trusting agent A with the actual arguments AA and/or actual 
answer S A. Further, the degree of security may be varied in accordance with the 
particular nature of the outsourced computation and various parameters associated 
with operations 220 and 260 of process 120. 
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Referring additionally to the block diagrams of Figs. 3 and 4, the preparation 
of disguised arguments DA and the recovery of actual answer SA are further 
described as performed by operations 220 and 260, respectively. Figs. 3 and 4 both 
include a block representative of outsourcing security program 230. Program 230 
5 resides in memory 34 and is configured to be executed by computer 32. In Fig. 3, 
program 230 receives actual arguments AA as input 222. Program 230 also receives 
input 224. Input 224 indicates the type of outsourced computation as determined 
through the classification performed in stage 133. 

Program 230 has access to one or more pseudorandom number generators 232 
ifl 10 residing in the form of one or more executable subroutines in memory 34. Also, 

M: memory 34 includes disguise library 234. Library 234 includes a number of different 

forms of argument disguise operations one or more of which are used to form a given 

W 

=^ set of disguised arguments DA. Various classes of the disguised operations are listed 

in table II that follows: 

y ii 

t 15 



No. 


Class 


1. 


Random Objects 


2. 


Linear Operator Modification 


3. 


Object Modification 


4. 


Domain and/or Dimension Modification 


5. 


Coordinate System Modification 


6. 


Identities and Partitions of Unity 



Table II 
10 
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The listing of Table II is meant to be merely representative, it being understood that 
other forms and classes of disguises may alternatively or additionally be included as 
would occur to those skilled in the art. 
5 The first class of disguises are random objects: numbers, vectors, matrices, 

permutations, or functions, to name a few. These objects are "mixed into" the 
computation in some way to disguise it, and are at least in part created from random 
numbers. If the nimibers are truly random, then they should be saved in record 236 
for use in the disguise and recovery of actual answer SA. If the random numbers 
10 come from a pseudorandom niunber generator, such as generators 232, then it is 
sufficient to save the seed and parameters of the generator in record 236. 

Under some circumstances, it may be desirable to hide as much information 
as possible about the characteristics of the random number generation technique 
utilized. It should be appreciated that once the distribution characteristics are known, 
S 15 it may become easier to detect true data being obscured by the random numbers. For 

fl example, if random numbers generated uniformly in some interval centered at zero 

where each added to a different entry of a large vector to be hidden, the random 
values would not do a good job of "hiding" the true values of the vector entries 
because the sum of the modified vector entries would be very close to the sum of the 
20 true value entries of the vector given the relationship of the random values to zero. 

In one embodiment, rather than using a pseudorandom number generator with 
the same probability distribution for every random number utilized, the exact form of 
distribution used may be varied from one random value to the next. Thus, random 
number generators 232 may each have a different distribution to better hide their 
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corresponding probabilistic characteristics. For this approach, random number 
generators 232 may further be arranged to provide a one-time random sequences. To 
illustrate, let four random number generators 232 be designated as: Gl = a imiform 
generator with upper range and lower range parameters; G2 = normal generator with 
5 mean and standard deviation parameters; G3 = exponential generator with mean and 
exponent p^ameters; and G4 = gamma generator with mean and shape parameters. 
Thus, for this illustration each generator G1-G4 has a different pair of distribution 
parameters. Twelve random numbers are selected: the first 8 are the parameter pairs 
of the four generators G1-G4 and the other four, are the ai, a2, a^, cu coefficients used 

10 to create the one time random sequence, as indicated by expression (1) that follows: 

aiGl + a2G2 + asGS + a4G4 (1) 
Note that in creating this one set of random nimibers, a total of 16 numbers are used, 
the 8 generator parameters, the 4 coefficients ai- a4, and 4 seeds for generators Gl- 
G4, respectively. In other embodiments, a different number and configuration of 

15 random number generators may be utilized to provide a desired set of random 



a numbers. In one alternative embodiment, the desired level of security for a given 

problem not require more than one random number generator to provide desired 
random objects. For still another embodiment, random numbers may not be used at 
all, instead utilizing other disguise operations according to the present invention. For 
20 this embodiment, generators 232 may be absent. 

One way security techniques based on random numbers might be defeated 
includes a type "statistical attack" that attempts to derive information about a given 
random number generator through matching the numbers to those produced by known 
random number generation techniques. Typically, the amount of processing needed 
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to derive such information for robust random number generators is cost prohibitive. 
However, this type of attack may still be of concern in alternative embodiments where 
a higher level of security is desired - especially with the rapid advancement of 
computer processing technology. 

Correspondingly, in addition to the one-time random sequence generation 
techniques previously described in connection with expression (1), the ]:esistance of 
random number generators to a statistical attack in such alternative embodiments may 
be addressed by: (a) using random number generators 232 with real valued 
parameters having at least a 32 bit length whenever possible; (b) restarting random 
number generators 232 from time-to-time with new input values; and/or (c) changing 
the type of random number generators 232 used from time-to-time. 

Another type of statistical attack is to attempt to determine the parameters of 
the probability distribution used to generate a group of random numbers. For this 
type, one can estimate the moments of the probability distribution by computing the 
moments of a collected sample of generated random numbers. The mean of the 
sample of size N converges to the mean of the distribution with an error that generally 
behaves according to 0(\i4n ); where the fimction 0(1/ VjV ) corresponds to 
processing time on the order of 1/ . While this rate of convergence is slow, a 
large sample of 10,000,000 may be utilized to provide estimates of moments with 
accuracy of about 0.03%. An alternative embodiment may be arranged to address this 
piarameter-based statistical attack by: (a) using random number generators 232 with 
complex probability distribution functions to increase the number of different 
moments that need the attacker needs to defeat the security; (b) restarting the random 
number generator from time-to-time with new input values such that the sequence size 
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generated with a given value is restricted; and (c) increase the number of parameters 
utilized to characterize the random number generator probability distribution function. 

Once random numbers have been provided using one or more of these 
embodiments, then random vectors, matrices, and arrays may be generated using 
standard techniques. Random objects with integer (or discrete) values, such as 
permutations, also can be created from random nimibers using standard techniques. 

Random objects may further include determining one or more random 
functions in accordance with a set of random numbers. One embodiment of a random 
function determination routine that may be provided in program 230 begins with the 
selection of the dimension or basis of a corresponding function space F. Typically the 
basis should be relatively high to promote a greater degree of security. For example, 
a basis of 10 or 30 functions for a high dimensional space F of functions may be 
selected. Next, a random point in F is determined with one or more generators 232 to 
obtain a random function. The selection of the basis and other parameters, such as the 
domain and range of the desired random functions should be selected to be 
compatible with the computation to be disguised and generally should have high 
linear independence when a stable inversion of disguised results DR is desired. 

To provide space F as a one-time random space, the following process may be 
included in the routine: 

(a) Define the domain of the computation to correspond to a box 
(interval, rectangle, box, or other corresponding construct depending on the 
selected dimension). 
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(b) Select a random rectangular grid in the box with 10 lines in 
each dimension and assure a minimum separation. 

(c) Generate K sets of random function values at all the grid points 
(including the boundaries), one set for each basis function desired (these 
values are selected to be in a desired range). 

, (d) Interpolate these values by cubic splines to create. K basis 
functions. The cubic splines may be formed in accordance with C. deBoor, A 
practical Guide to Splines , SIAM Publications, (1978) which is hereby 
incorporated by reference in its entirety. It should be appreciated that cubic 
splines are smooth and have two continuous derivatives. 

(e) Add to this set of K basis functions a basis for the quadratic 
polynomials. 

This approach can be modified to make many kinds of one-time random spaces of 
functions. If functions with local support are needed, the cubic splines may be 
replaced with Hermite quintics as described in deBoor. If it is desirable for the 
functions to vary more in one part of the domain than another, then the grid may be 
refined in the corresponding part. If it is desirable for the functions to be more or less 
smooth, then the degree of smoothness of the cubic splines may be adjusted as 
appropriate. In still other embodiments, other techniques of random function 
generation may be utilized as would occur to those skilled in the art. 

One way an attacker might try to defeat disguises based on random functions 
is through an "approximation theoretic attack." This type of attack can based on 
observations about the approximating power of the disguised functions. In one 
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example, let u(x) be an original function, and f(x) be a disguise function in function 
space F such that g(x) = u(x) + f(x) is observable by agent A. Agent A may evaluate 
g(x) arbitrarily and, in particular, agent A might (if F were known) determine the best 
approximation g*(x) to g(x) from F. Then the difference g*(x) - g(x) equals 
u*(x)- u(x) where u*(x) is the best approximation to u(x) from F. • Thus g*(x) - g(x) is 
entirely du? to u(x) and gives some information about u(x). 

An alternative embodiment arranged to address an approximation theoretic 
attack includes choosing F to have very good approximating power so that the size of 
g*(x) - g(x) is small. For example, if u(x) is an "ordinary" function, then including in 
F the cubic polynomials and the cubic splines with 5 or 10 breakpoints (in each 
variable) generally improves approximation power. If u(x) is not "ordinary" (e.g., is 
highly oscillatory, has boxmdary layers, has jumps or peaks) then including functions 
in F with similar features reduces the ability of agent A to discover information about 
u(x) from g(x). Another aspect that makes this kind of attack more difficult is to 
establish F as a one-time random space as previously described. For this aspect, 
because F itself is then imknown, the approximation g*(x) cannot be computed 
accurately and any estimates are correspondingly less uncertain. Still a further aspect 
is to approximate the function object u(x) with high accxxracy, such as a variable 
breakpoint piecewise polynomial, and adding one or more disguise functions with the 
same breakpoints and different values. Yet, in other embodiments, it may not be 
desired to take additional measures to address a statistical attack, an approximation 
theoretic attack, or both. 

The second class of disguise operations include linear operator modification; 
where the operator equation is of the form Lu = b. For example, the linear and 
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differential equations of the following expressions (2) and (3), respectively, are of this 
form: 

linear equations: Ax = b (2) 

differential equations: y" + cos(x)y' + x^y = 1 - xe"^ (3) 

5 This second class of disguises exploits linearity by randomly choosing v like u, i.e., v 
is the same, type of mathematical object, and then solving L(u + v) = b + Lv; where Lv 
is evaluated to be the same mathematical object type as b. In one embodiment, v is 
selected to be a combination of a random function and functions that already appear in 
the equation. For example, one could choose v(x) in the above differential equation 
10 (3) to be VRan(x) + 4.2cos(x) - 2,034xe where VRan(x) is the random function 

component. In still other embodiments, different substitutions may be made as would 
occur to those skilled in the art. 

A third class of disguise operations modify various mathematical objects of 
the computation to be outsourced. Such modifications may include addition or 
15 multiplication to disguise the computation. One example of an objection modification 
disguise is to add a random function to an integral as exemplified by expression (4) 
that follows: 



|Vxcos(x+3) (4) 



In another example of object modification, the solution of the Ax = b may be 
20 disguised by multiplying with 2 random diagonal matrices, Di and D2, to provide B - 
Di AD2 with subsystem 30; where A is an n x n matrix and b is a corresponding vector 
of n. The resulting matrix B is then provided as part of the outsourced computation of 
expression (5) as follows: 

17 



4-48409/7024-395 

By = D,b (5) 
The solution x is then obtained from x=D2y. 

In a fourth class of disguises, the domain or dimensions, are modified. 
Modification techniques may include expansion, restriction, splitting or 
rearrangement. In an example of expansion, the evaluation of the integral of 
expression (6) that follows: 

I 



JVxcos(x-l-3) (6) 



0 

or solution of the problem of related type on [3,5] as shown in expression (7) that 
follows: 

y'(x)-(x + y)e-'^, y(3)=l (7) 

can be modified by expanding [0,1] to [0,2] and [3,5] to [2,5], respectively. In the 
case of expression (6), a random function u(x) is selected from function space F with 

u(l) = cos(4); it is integrated on [1,2]; and ^fx cos(x + 3) is extended to [0,2] using 

• t , 

u(x). In the' second case of expression (7), a random function u(x) is selected from 
function space F v^th u(3) = 1 and u'(3) = 4e Its derivative u'(x) and its value u(2) 
are computed, and the following expressions (8) is solved with initial condition y'(2) 
= u\2): 

y'(x)-(x + y)e-'^y on [3,5] (8) 
= uXx) on [2,3] 



In an example of restriction, the dimension of a linear algebra computation is 
decreased by performing a part of it with subsystem 30, and outsourcing the rest, for 
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example, in solving Ax = b, (where A is an n x n matrix and b a corresponding vector 
of dimension n), one of the unknowns is selected and eliminated by Gauss elimination 
at random by customer C (subsystem 30); and the remaining computation is then sent 
to the agent A (computing center 50). Correspondingly, the order of the matrix 
changes by 1 and, further, it modifies all the remaining elements of A and b. 

In Bfi example of splitting, a problem is partitioned into equivalent 
subproblems by splitting the domain. In the case of quadrature, this technique may be 
readily applied. The linear algebra problem Ax = b, (where A is an n x n matrix and b 
a corresponding vector of dimension n), can split by partitioning in accordance with 
the following expression (9): 

and creating two linear equations as shown in following expressions (10) and (11): 
AiiXi = bi-Ai2X2 (10) 
(A22 - A2iAn "^A,2)X2 = b2 - Au'^bi (11) 

■ t , 

In another example, the differential equation problem of the following 
expressions (12); 

y'(x) = (X -f y)e-^y and y'(3) = 1 on [3,5] (12) 

can be split into the expressions (13) and (14) that follow: 

it * 

y'(x) = (x + y)e-'^ y'(3) = 1, on [3.4] (13) 
y'(x) = (x + y)e ~^ y'(u) = as computed, on [4,5] (14) 
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Accordingly, splitting may be utilized to disguise different computation parts in 
different ways. 

A fifth class of disguise operations include utilizing one or more coordinate 
system changes. A related disguise for discrete problems, such as a linear algebra 
computations, are permutations of the corresponding matrix/vector indices. 
Coordinate system changes have been found to be particularly effective for enhancing 
security of outsourced computations concerning optimization and solutions to 
nonlinear systems. For example, consider the two-dimensional partial differential 
equation (PDE) problem of the following expression (15): 



vV(a:,y) + (6.2 + 12sin(x-hy))/ = ffi(x,j/) (x,y) in R 

/(x,y) = 6i(x,y) (x.y) in Ri (15) 

/(x,y) = 62(a:,y) (x,y) in R2 

+^2(x,y)/(x,y) = 63(x,y) (x,y) in R^ 



where Ri, R2, and R3 comprise the boundary of R. To implement the change of 

1 5 coordinates, u == u(x,y), v = v(x,y), one must be able to: invert the change, that is find 

I 

the fiinctioiis x = x(u,v), y = y(u,v) and compute derivatives needed in the PDE as 
given in the following expression (16): 



" au2 \dx^ ) dudx^ dv^ \dx) dv dx^ 



10 
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The change of coordinates produces an equivalent PDE problem on some domain D 
in (u,v) space of the form given by the following expression (17): 
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Eij=oaii(u,t;)gg|3-/(u,v) = hi{u,v) (u.v) eS 

/(u.t;)=ci(u,t;) (u.t;)€5i ^^^^ 

f{u,v) = C2(u,v) (ti,i;) € 52 

di(u,t;)^^ +d2(u,v)%2i + ds{u,v)f{u,v) = C3(u,t;) (u,t;) e 53 

where Si, S2, and S3 are the images of Ri, R2, R3 and the functions aij(u,v), hi(u,v), 
Ci(u,v), di(u,v) are obtained from substituting in the changes of variables and 
collecting terms. 

There are a number of coordinate changes where the inverse is known 
explicitly. In cases where the availability of this knowledge may unacceptably 
compromise security, other coordinate changes may be utilized by determining the 
inverse numerically. In one embodiment, the procedures described to create one-time 
coordinate changes using parameterized mappings with randomly chosen parameters 
in C. J. Ribbens, A fast adaptive grid scheme for elliptic partial differential equations , 
ACM Trans. Math. Softw., 15, (1989), 179-197; or C. J. Ribbens, Parallelization of 

adaptive grid domain mappings . In Parallel Processing for Scientific Computings (G. 

• t 

Rodrique, 6d.), SIAM, Philadelphia, (1989), 196-200) may be utilized to numerically 
determine inverses for this class of disguise and are hereby incorporated by reference 
in their entirety herein. In one variation of this embodiment, coordinate changes in 
the variables are made independently - that is: u = u(x) and v = v(y). 

A sixth class of disguises include substitution with equivalent mathematical 
6bjects, such as identities, and partitions of unity. It has been found that this type of 
disguise improves security even when random objects are readily separated from 
"actual" objects of a given computation. 
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Examples of identities that might be utilized in this way include the following 

collection of expressions (18): 

a2 - ox + x2 = (o^ + x3)/(a + x) (18) 
log(xy) = log x + logy 
l + x = (l-x2)/(l-x) 
sin(x + y) = sinxcosy + cosxsiny 

cos^ X = sin ^ y + cos (x + y) cos(x - y) 

pcosx + 9sin(y) - y/p^ + cos(x - cos'^b/ x/p^ + q'-^)) 
sin(3(x + y)) = 3sin(x + y) - 4sin3(x + y) 

Thus, if any component of these identities appears symbolically in a computation, the 
equivalent expression can be substituted to disguise the problem. A general source of 
useful identities for this class of disguise comes from the basic tools for manipulating 
mathematics, e.g., changes of representation of polynomials (power form, factored 
form, Newton form, Lagrange form, orthogonal polynomial basis, etc.), partial 
fraction expansions or series expansions. Other relations that may be useful in 
disguises of this kind include the Gamma, Psi, and Struve functions as respectively 
defined by expressions (19)-(21) as follows: 

r(x+l) = xr(x); (19) 

I 

' v^(x+l) = tf/(x) +l/x; and (20) 
H,/2(x) = (2/7CX)*''(l-COSX). (21) 
The functions of expressions (19)-(21) can be combined with selected expressions 
(18) to provide the following identity expressions (22) and (23): 

sin(x) = [sin(v/(l + 1/x) + x) - sin(v/(l/x))cos x]/ cos(y/(l/x)) (22) 
log(x) - logr(x) + log(r(x = l)Hi/2(x)) - log(l - cosx) + l/21og(7cx/2) (23) 
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Identities that are equal to 1 are generally referred to as partitions of unity. 
Partitions of unity can be readily used in a given computation. Examples of this form 
of identity are collected as the following expressions (24): 

sin^x+cos^x = 1 (24) 
5 sec^(x + y) - tan^(x + y) = 1 

' (tanx + tany)/tan(x-l-y) + tanxtany = 1 

bi(r,x) + b2(r,s,x) + b3(r,s,x) + b4(s,x) = 1 
where the bi are "hat" functions defined by: 

bi(r,x) = max(l - x/r,0) 
£5 10 b2(r,s,x) = max(0, min(x/r,(s - x)/(s - r))) 

1-^ b3(r,s,x) = max(0,min((x - r)/(s - r),(l - x)/(l - s))) 

b4(x,s) = max(0,(x - s)/(l - s)) 
each of which is a piecewise Unear function with breakpoints at 0, r, s and/or 1 . 
Generalizations of this partition of unity are known for an arbitrary number of 

15 functions, arbitrary polynomial degree, arbitrary breakpoints, and arbitrary 

• I ^ 

smoothness' (less than the polynomial degree). Partitions of unity facilitate the 
introduction of unfamiliar and unrelated functions into symbolic expression. Thus the 
second partition of expressions (24) above becomes the following expression (25): 

20 sec\y7(x) + u(l .07296, x)) - tan^(y7(x) + u(l .07296,x)) = 1 (25) 

,* * 

where y7(x) is the Bessel function of fractional order and u(l. 07296, x) is the 
parabolic cylinder function. R.F. Boisvert, S. E. Howe, and D. K. Kahaner, Guide to 
Available Mathematical Software (GAMSV A framework for the management of 



i U! 
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scientific software , ACM Trans. Math. Software, 11, (1995), 313-355, lists 48 classes 
of fiinctions for which library software is available and is hereby incorporated by 
reference. 

Further, disguises may be enhanced by using fiinctions and constants that 
appear in the actual arguments AA. Thus, if 2.70532, x^, cos(x) and log(x) initially 
appear in ap ordinary differential equation, one could use identities that involve these 
objects or closely related ones, e.g., 1.70532, 2x^ - 1, cos(2x) or log (x + 1). Because 
of the difficulty in establishing identities, it is expected that using several identities in 
a mathematical model provides a corresponding increase in the degree of security. 
Further, one-time identities as follows may be provided. For example, there are 
several library programs to compute the best piecewise polynomial approximation to 
a given function f(x) with either specified or variable breakpoints as described 
in C. deBoor and J.R. Rice, An adaptive algorithm for multivariate approximation 
giving optimal convergence rates , J. Approx. Theory, 25, (1979), 337-359; and C. 
deBoor. A Practical Guide to Splines . SIAM Publications, (1978) that are hereby 
incorporated by reference in their entirety herein. It should be aplpreciated that with 
these techniques, the number of breakpoints and/or polynomial degrees can be 
increased to provide arbitrary precision in these approximations. Thus given the 
following expression (26): 

f(x) = sin(2.715x + 0.12346) / (1 .2097 + x*^^^^) (26) 

■> * 

or that f(x) is computed by a 1000 line code, one can use these library routines to 
replace f(x) by a code that merely evaluates a piecewise polynomial with 
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"appropriate" coefficients and breakpoints. One time identities may also use the 
classical mathematical special functions that have parameters, e.g., incomplete 
gamma and beta functions, Bessel function, Mathieu functions, spheroidal wave 
functions, and parabolic cylinder functions as further described in M. Abramowitz 
and I. A. Stegun, Handbook of Mathematical Functions^ Appl. Math. Series 55, 
National Bureau of Standards ., U. S. Govt. Printing Office, (1964) that is hereby 
incorporated by reference in its entirety herein. 

Having described a few different classes of disguises as listed in table II, it 
should be appreciated that this description is not intended to be exclusive, it being 
understood that other types of disguises as would occur to those skilled in the art are 
also contemplated. Further, while in some embodiments it is desirable to apply only 
one particular disguise operation prior to outsourcing, in other embodiments it may be 
desirable to enhance the degree of security by applying multiple disguise operations. 
Indeed, for a given type of outsourced computation, within each class of table II there 
may be several or many disguises that can be simultaneously utilized with or without 
disgixises of one or more other classes. Likewise, some classes of disguises in library 
234 may be better suited to obscure or hide the actual arguments AA for a given type 
of outsourced computation than others. For example, it has been foimd that 
coordinate system changes are one of the more effective disguises for outsourced 
computations involving optimization and solutions of nonlinear systems. 

The selection of one or more disguises from library 234 and construction of a 
multiple disguise procedure may be based on several factors. One factor is the 
motivation to outsource. If the motivation includes a relative savings in processing 
time, then the time taken to perform operations 220, 260 should not defeat such 

25 



4-48409/7024-395 




savings. For example, if the problem domain involves n x n matrices, then an 
operation count for operations 220, 260 on the order of n^ might be acceptable to 
provide security for an outsourced computation that has an operation count on the 
order of n^, as is commonly associated with matrix inversion and multiplication. 
However, if the motivation concems other matters such as availability of software or 
programmipg expertise, the relative processing time may be unimportant. Moreover, 
it should be understood that the invention is not intended to be limited to a particular 
motivation or relative distinction regarding the outsourced computation. 

Another factor is the invertability of the disguised result DR once the 
outsourced computation is completed. For example, it may be desired that the 
disguise be fully invertible - that is, after the disguise is applied and the disguised 
computation made, the actual answer S A may be recovered that corresponds to the 
actual arguments AA. Still, in other embodiments, it may only be desired that an 
approximated recovery be performed, so that the degree of recovery of actual answer 
S A may vary. 

' Still'another factor is the degree of security afforded by a'given form of 
disguise. Ideally, once a given disguise is applied, agent A (computing center 50) 
should not be able to discover either the original computation or its result; however, in 
practice, the level of security utilized may vary for a given situation. Yet another 
factor to consider is the relative cost of a particular disguise procedure. Generally, 
this operates as a trade-off with the degree of security sought. 

Program 230 is arranged to provide sequencing control of a disguise, 
outsourcing, retrieval and disguise inversion actions. As part of operation 220 
illustrated in Fig. 3, program 230 receives the actual arguments AA as input 222 and 
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the type of computation selected to be outsourced as input 224. In response, program 
230 selects one or more disguise operations from library 234 in accordance with a 
suitable disguise procedure for inputs 222, 224. Program 230 may include a number 
of predetermined disguise procedures based on input 222 and/or input 224, operator 
input, one or more routines to synthesize a suitable procedure, or a combination of 
these. , 

In one embodiment, a routine to synthesize or suggest the disguise procedure 
may be determined, at least in part, from inputs corresponding to one or more of the 
previously described factors listed as follows: (a) outsourced computation type, (b) 
type/quantity of actual arguments, (c) processing constraints of subsystem 30 (such as 
the amount of preparation/recovery processing to be performed by subsystem 30), (d) 
motive for outsourcing, (e) degree of secxuity desired, and (f) cost constraints. In still 
other embodiments, these factors may not be considered by program 230. Indeed, in 
one alternative embodiment, the particular disguise procedure is completely manually 
entered by an operator. 

' Once the disguise procedure is determined, program 230 constructs the 
disguised arguments DA using the selected disguise operations from library 234. 
Program 230 also coordinates the storage of appropriate disguise parameters in 
outsourced computation record 236 for later retrieval to recover the actual answer SA. 
Among its disguise operation routines, program 230 includes one or more routines to 
provide appropriate random objects with random number generators 232 as needed 
for a particular disguise procedure. A record 236 is maintained by program 230 for 
each outsourced computation at least until a result is received and processed via 
operation 260. Typically, the recorded parameters include relevant random numbers 
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or corresponding keys for one or more random numbers, the selected disguise 
operations applied, a reference to actual arguments AA corresponding to the given 
outsourced computation, and such other information as required to recover actual 
answer SA. After the disguised arguments DA are created, they are sent to the 
selected agent A, such as computing center 50, as output 250. 

Depending on a given disguise procedure, a substantial number qf "keys" may 
be needed to reconstruct an actual answer SA from a disguised result DR. For 
example, if a significant nimiber of random objects are used, random number 
generator parameters, generator seeds, related coefficients and/or perhaps the random 
numbers themselves may be maintained in a corresponding record 236. It may be 
desirable to avoid keeping and labeling these keys individually. In one alternative 
embodiment of program 230, a master key is created that may be stored in record 236 
in lieu of a large number of keys for a given outsourced computation. This master key 
is provided to create an arbitrary number of derived keys or "sub-keys." For this 
embodiment, let K be the master key and kj, i = 1,2,. ..,N be the sub-keys (where "i" is 
an integer index variable). The sub-keys ki are derived from K by a procedure P such 
as the following: 

(a) represent K as a long bit string (a 16 character key K generates 
128 bits using ASCII notation); 

(b) generate a bit string of length 128 bits with a random number 
generator G for each i - 1 ,2, . . . ,N; and 

(c) apply the randomly generated bit string of length 128 as a mask 
on the representation of K — select those bits of K where the random bit is 
one. 
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Thus, with a single key K and a random number generator G (such as one of 
generators 232), we can create many sub-keys. It should be appreciated that for 
procedure P, each kj is easily derived from K; however, knowledge of even a 
substantial set of the k\ gives no information about K even if the generation procedure 
P is known. Correspondingly, because many of the sub-keys may be seeds or 
parameters 'for random number generators, large sets of random nimibers can be used 
with a reduced risk of revealing the master key or other sub-keys even if a statistical 
attack on this aspect of the disguise is successful. 

Referring to Fig. 4, program 230 receives disguised result DR from computing 
center 50 as input 262. Program 230 references the corresponding record 236 to 
determine the processing needed to recover actual answer SA from the disguised 
result DR. The actual answer SA is provided as output 264 by program 230. 

Having described process 120 and operations 220, 260, the following 
examples of different types of outsourced computations are described, it being 

xmderstood that these examples are merely illustrative and should not be considered 

t , 

limiting or restrictive in character. These examples are described in terms of system 
20 and process 120; however, other systems and processes may be utilized to execute 
these examples as would occur to those skilled in the art. Further, it should be 
xmderstood that program 230 may include instructions or routines in accordance with 
one or more of the disguise operations of these examples, but one or more different 
pi^ograms and/or operator input of one or more operations may be utilized. Likewise, 
computer 52 of computing center 50 may be programmed to execute the outsourced 
computations associated with these examples, or different agents A may be used for 
the various procedures described in the examples. 
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EXAMPLE ONE 

Matrix multiplication of two n x n matrices Mi and M2 may be readily 
disguised in accordance with a first example of the present invention designated as 
disguise procedure DPI. Matrices Mi and M2 are the actual arguments AA to be 
outsourced., For DPI, the kronecker delta function, 5 -^y is utilized which equals 1 if 
X = y and 0 if x y. Subsystem 30 performs the following stages a.-c. to prepare 
disguised arguments DA in accordance with DPI : 

a. creates (i) three random permutations 711, 7i2, and ttS of the integers 
{ 1 ,2,. . .,n} and (ii) three sets of non-zero random numbers 

{ ai, a2,...,an}, {pi, p2,...,Pn}, and {yi, y2....,Yn}; 

b. creates matrices Pi, P2, and P3 where Pi(i, j) = aiS„i(i)j, P2(i, j) = 
Pi5,t2(i)j, and PaCij) = Yi8K3(i)j (these matrices are readily invertible, e.g.. 

Pi = (aj)"^8„i"\i)i); and 
. c. computes the matrix X = PiMiP2*^ (such that X(ij)= (ai/pj)Mi(7cl(i), 

7c2(j))),and Y = P2M2P3"*. 

Matrices X and Y define the disguised arguments DA for DPI . Subsystem 30 sends 

the matrices X and Y to computing center 50. Computing center 50 determines the 

product Z = XY = (PiMiP2"^) (^iMi^z'^) = P1M1M2P3"' and sends matrix Z back to 

subsystem 30. Matrix Z is the disguised result DR for DPI . 

Subsystem 30 computes locally, in O(n^) time, the matrix Pf^ZPa, which 

equals M1M2, the actual answer SA; where the fimction O(n^) represents processing 

time on the order of and proportional to n^. It should be appreciated that the 
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outsourced computation by computing center 50 for DPI requires processing 
proportional to n"^ as represented by 0(n^). 

EXAMPLE TWO 

5 At the expense of more complex disguise preparation by subsystem 30, a 

greater degree of security may be provided in a second matrix multiplication example 
designated as disguise procedure DP2. For DP2, subsystem 30 performs the 
following stages a.- c: 

a. compute matrices X = PiMiP2"^ and Y = P2M2P3"^ in accordance 
1 0 with disguise procedure DP 1 ; 

b. select two random n x n matrices Si and S2 and generate four 
random numbers p, y, p*, Y such that (p + y)((P' + Y'Xy'P - Yp') ^ 0; and 

c. compute the six matrices X + Si, Y + S2, pX -^Si, pY ^82, 
H p'X-y'S,.p'Y-y'S2. 

P 15 

h 

i . I 

3 The following three matrix multiplications are then outsourced by subsystem 30 to 

computing center 50: (a) W = (X + Si)(Y + S2); (b) U = (pX - yS,)(PY - ySj); and (c) 
U' = (P'X - y'SiXP' Y - y'S2). The results are returned by computing center 50 to 
subsystem 30. Subsystem 30 then locally computes matrices V and V; where 
20 V = (p + 7) (U + pyW) and V = (p' + y') (U' + P'y'W). It should be appreciated 
that V = pXY 47SiS2.and V ' = p'XY + y ' S1S2. Subsystem 30 outsources the 
computation: (y'p - yp') (y' V - yV) as the disguised arguments DA which equal 
the product XY. Computing center 50 returns the remotely computed matrix product 
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XY (the disguised result DR); and subsystem 30 computes M1M2 from XY 



according to: Pi "^XYPj - Pi (P1M1P2 "')(P2M2P3 " )P3 = M1M2. 



EXAMPLE THREE 



Disguise procedure DPS as follows provides a third example of a disguised 
outsource4 matrix multiplication. DP3 utilizes DP2 and further imposeg control on 
the length of random niunber sequences generated to provide a more robust random 
number generator disguise. For DPS, subsystem SO defines L as the maximiun length 
for a sequence from a random number generator so that M = [m/L] is the nimiber of 
distinct random number generators 2S2 needed. Let G(A(i)), i = 1,2...,M be one-time 
random number generators. Each random generator has a vector A(i) of 12 
parameters/seeds. Correspondingly, non-zero vectors are provided for the three 
matrices Pi, P2, P3 used to disguise Mi and M2. Computing center 50 receives X = 
P1M1P2 and Y = P2M2P3 for the outsourced multiplication and returns matrix Z to 
subsystem SO. This approach fiirther hampers the ability to successfiiUy impose a 
statistical attack. Further, as long as computing center 50 is without information 
about Ml and M2, it appears a statistical attack is the only type of attack available. 



In a fourth example, disguise procedure DP4 for the multiplication of non-square 
matrices is utilized; where Mi is / x m and M2 is m x n, and hence: M1M2 is / x n. 
For DP4, any of the procedures DPI , DP2, DPS may be utilized with the sizes of the 
Pi and Si matrices being selected accordingly. For matrices Si of DP2 or DPS, Si is of 
/ X m dimension and S2 is of m x n dimension, because each of them is added to 
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matrices having such dimensions. For the matrices Pj it should be appreciated that Pi 
is constrained to be: (i) square so that it may be inverted, (ii) sized to be compatible 
with the number of rows of the matrices that it (or its inverse) left-multiplies, and (iii) 
sized to be compatible with the number of columns of the matrices that it (or its 
inverse) right-multiplies. For example, as P2 is used for left-multiplying M2. and M2 
has m row?, P2 should be m x m. The constraint that P2"' right-multiplies Mi is 
compatible with the previous one, because Mi has m colunms. 

EXAMPLE FIVE 

In a fifth example, dimension hiding is included for an outsourced matrix 
multiplication as disguise procedure DPS. For DPS, subsystem 30 defines Mi with 
dimension a x b matrix and M2 with dimension b x c matrix. Two or more matrix 
multiplications using one of the previously described matrix multiplication procedures 
DP1-DP4 are performed instead of just one. These substitute multiplications are 
performed with matrices having dimensions a', b', c' different fi-om a, b, c. Hiding the 
dimensions' can be done by either enlarging or shrinking one (or'a combination of) the 
relevant dimensions. A dimension a is "enlarged" if a' > a, and "shrunk" if a* < a 
(similarly for b* and c'). Although for convenience enlargement and shrinking are 
described separately, it should be imderstood that these operations alternatively can be 
done in combination. 

Enlarging a (so that it becomes a' > a) is performed by subsystem 30 by 
appending a' - a additional rows, having random entries, to matrix Mi. As a result, 
product M1M2 has a - a additional rows that may be ignored. Enlarging c (so that c* > 
c) is performed by subsystem 30 by appending c - c additional colunrms, having 
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random entries, to matrix M2, causing the resulting product of M1M2 to have c - c 
additional columns, that can be ignored. 

Alternatively or additionally, subsystem 30 may enlarge vector b by 
appending b - b extra columns to the first matrix and b - b extra rows to the second 
5 matrix. It should be appreciated that these additional rows and columns carmot have 
completely random entries because they may interact to cormpt the outsourced 
calculation result. Accordingly, to avoid any corruption, subsystem 30 preserves the 
dimensions of the resulting product matrix M1M2 by: (a) numbering the b - b extra 
columns 1,2,..., b- b, and similarly numbering the extra rows 1,2,..., b'- b; (b) 
1 0 selecting the entries of the odd-numbered extra colimms and rows to be random and 

i!^ zero, respectively; and (c) selecting the entries of the even-numbered extra colunms 

; % and rows to be zero and random, respectively. These operations assure that enlarging 

b does not cause a change in the matrix product M1M2. For embodiments that enlarge 

IM b in conjunction with enlargements of a and/or c, the enlargement of b is preferably 

=P 15 performed first. 

■fl ' Dimensional shrinking of a may be performed as part of DPS with subsystem 

30 by partitioning the first matrix Mi into two matrices: Mi* having the first a - a rows 
and Ml" having the last a* columns. Matrix M2 stays the same, but to get the a x c 
matrix, both products Mi'M2 and Mi"M2 are outsourced. Dimensional shrinking of c 
20 is performed by partitioning the second matrix M2 into two matrices: M2' having the 
first c - c columns and M2" having the last c* columns. Matrix Mi stays the same, but 
to get the a X c matrix, both products M1M2' and M1M2" are outsourced. 

Additionally or alternatively, DPS may include dimensional shrinking of b. 
Subsystem 30 shrinks b by partitioning both matrices Mi,M2 into two matrices. 
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Matrix Ml is partitioned into matrix Mi* having the first b - b* columns and matrix Mi" 
having the last b' columns. Matrix M2 is partitioned into matrix M2' having the first b 
- b* rows and matrix M2" having the last b' rows. The axe product matrix sought is 
then Ml W+ MiW. 

DPS also optionally includes performing the three above shrinking operations 
together. This option results in a partition of each of matrices Mi and M2 into four 
matrices. Using, for example, the notation Mi([i:j], [k:l]) for the submatrix of Mi 
whose rows are in the interval [i:j] and whose colimms are in the interval [k:l], then 
computing M1M2 requires the following four computations (a)-(d): 

(a) Mi([l : a - a'],[l : b - b'])M2(l : b - b'],[l : c - c']) + 

Mi([l : a - a'],[b - b' + 1 : b])M2([b - b' + 1 : b],[l : c - c']); 

(b) Mi([l : a - a'],[l : b - b*])M2(l : b - b'],[c - c' + 1 : c]) + 

Mi([l : a - a'],[b - b' + 1 : b])M2([b - b' + 1 : b],[c - c' + 1 : c]); 

(c) Mi([a-a' + l :a],[l : b-b'})M2([l: b-b'],[l :c-c']) + 

Mi([a - a' -h 1 : a],[b - b' + 1 : b])M2([b - b' + 1 : b],[l : c - c']); and 
' (d)«Mi([a-a' + 1 :aMl : b-b'})M2([l: b-b'],[c-c' '+1 :c]) + 

Mi([a - a' + 1 : a],[b - b' + 1 : b])M2([b - b' + 1 : b],[c - c' + 1 : c]). 

EXAMPLE SIX 

In a sixth example, a secure matrix inversion disguise procedure DP6 is 
provided for matrix M; where the entries of matrix M are the actual arguments AA. 
For DP6, the following steps a.- j. are performed: 

a. Subsystem 30 selects a random n x n matrix S. 
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b. Subsystem 30 securely outsources the matrix computation C = MS 
by executing one of the previously described procedures DP 1-3 or DPS as a 
subroutine of DP6. 

c. Subsystem 30 generates matrices Pi, P2, P3,P4,P5 using the same 
method as for the Pi matrix of DPI . That is, Pi(i j) = ai6«i(i)j, PaG j) = bi5;t2(i)j, 
PaCij) = Ci6;c3(i)j, P4(ij) = di8;t4(i)j, and PsCi j) = ei5;i5(i)j, where tcI , 7t2, 7r3, 7c4, nS 
are random permutations, and where aj, bi, Cj^ ej are random nimibers. 

d. Subsystem 30 computes the matrices: Q = PiC;P2~* = P1MSP2"' 
andR = P3SP4"^ 

e. Subsystem 30 outsources the computation of Q'\ to computing 
center 50. 

f. If computing center 50 succeeds in determining Q"^ it returns Q"^ to 
subsystem 30; otherwise computing center 50 indicates Q is not invertible to 
subsystem 30. If this indication is received by subsystem 30, it tests whether: 

(i) S is invertible by first computing S = S1SS2; where Si and S2 are 
, matrices known to be invertible, and outsources matrix S to computing 
center 50 for inverting. It should be understood that the only interest is 
whether S is invertible or not, not in its actual inverse. The fact S is 
discarded makes the choice of Si and S2 less crucial; however, 
choosing Si and S2 to be the identity matrices may not be desirable 
because it may make it easier to leam how the random matrices are 
generated. 
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(ii) If computing center 50 can invert S, then S is invertible, and hence 
M is not invertible. If the computing center 50 indicates S is not 
invertible, then S is not invertible. In that case, operations (a)-(f) of 
DP6 are repeated with a different S. 

' g. If Q is invertible, then, in accordance with the observation that 
Q"' = P2S"^M'^Pf \ subsystem 30 computes the matrix T = P4 P2 Q Pi Ps"^ 
which is equal to P4 S 'M "^Ps"*. 

h. Subsystem 30 outsources the computation of Z= RT to computing 
center 50 which serve as disguised arguments DA. One of DP1-DP3 or DPS 
may be utilized as a subroutine for this operation. 

i. Computing center 50 returns Z, the disguised result DR, to 
subsystem 30. 

j. Observing that Z= P3SP4 ■'P4S "^M "'P5 == P3M "^Ps '\ subsystem 30 
computes Pa'^ZPs, which equals M "\ the actual answer SA. 

• t 

EXAMPLE SEVEN 
In a seventh example, dimensional hiding is incorporated into secure matrix 
inversion in disguise procedure DP7. For DP7, hiding dimension n for matrix 
inversion may be achieved by: (a) using the dimension-hiding version of matrix 
multiplication described in connection with procedure DP5 of Example Five, and (b) 
modifying stage "f." of DP6 to perform the inversion of Q by inverting a small 
number of n* x n' matrices where n* differs from n. Otherwise DP7 is performed the 
same as DP6. DP? provides an option of enlarging the dimension of Q, (i.e., n* > n) 
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for which stage "f." of DP6 is modified to invert one n* x n* matrix Q' defined as 
follows; where the matrices O', O" are of n x (n' - n ) and (n* - n) x n dimension, 
respectively, and all of whose entries are zero, and S' is an (n' - n) x ( n* - n) random 
invertible matrix: 

Q'([l :n],[l :n]) = Q; 
Q'([l:n],[n+1 :n']) = 0'; 
Q'([n + 1 : n'],[l : n]) = O"; and 
Q'([n+ 1 :n'],[n+ 1 :n']) = S'. 

It should be understood that the inversion of Q' is not performed by sending it directly 
to computing center 50 as the zeros in it may reveal n. Rather, the inversion of Q is 
performed in accordance with DP6. 

Dimension shrinking may optionally be included in DP7 based on the premise 
that if X = Q ([l:m], [l:m]) is invertible (m < n), Y = Q ([m +1: n], [m + 1: n]), V = Q 
([1 : m], [m + 1 : n]), W = Q ([ m + 1 : n], [1 : m]), and D = Y - WX V is invertible, 
then: i 

Q '([1 : m],[l : m]) = X'' + X-'VD-'WX"'; 
Q''([l : m],[m + 1 : n]) = -X-'VD '; 
Q '([m + 1 : n],[l : m]) = -D 'WX '; and 
Q"'([m + 1 : n],[m+ 1 : n]) = D '. 

Correspondingly, for DP7, Q is partitioned into four matrices X, Y, V, W. One of the 
secure matrix multiplication techniques DPI - DPS or DPS and the secure matrix 
inversion of procedure DP6 are utilized to determine the four pieces of Q"'. 
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EXAMPLE EIGHT 
In an eighth example of the present invention, secure outsourcing of a linear 
system of equations is provided as disguise procedure DPS. For a system of linear 
equations, the actual arguments may be represented in the form Mx=b; where M is a 
square n x,n matrix, b is a vector of dimension n, and x is a vector of n.unknowns. 
For DPS, the following stages a.- e. are performed: 

a. Subsystem 30 selects a random n x n matrix B and a random 
number j e { 1,2,. ..,n} and replaces the j-th row of B by b such that: 

B = [Bi,...Bj.i, Bj + 1, Bn]. 

b. Subsystem 30 generates matrices Pi, P2, P3 using the same method 
as for the Pi matrix in DPI, such that Pi(ij) = ai6„i(i)j, P2(iJ) = bi6„2(i)j, PsCij) 
= Ci57t3(i)j where nl , 7r2, n3 are random permutations, and where aj, bj, Cj. are 
random numbers. 

c. Subsystem 30 computes the matrices C = P1MP2 and G = PiBP3~\ 

! 

' d. Subsystem 30 outsources the solution of the linear system Cx = G 
to computing center 50. If C is singular then computing center 50 returns a 
message with this indication; otherwise center 50 retums: U = C'*G . 

e. Subsystem 30 computes X == P2 "'OPs which equals M "'B, because: 
P2"'UP3 = P2"'C -^fiPa = P2''P2M-'Pi ■*PiBP3"^P3 = M"'B; where, the 
answer x (actual answer SA) is the j-th column of X, i.e., x = Xj. 
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EXAMPLE NINE 

In a ninth example, dimensional hiding of a linear system of equations is 
provided by disguise procedure DP9. For DP9, dimension n of the linear system of 
equations is hidden by embedding the problem Mx = b into a larger problem M*x' = b' 
of the size n' > n. In what follows, if X is an r x c matrix and Y is and r* x c' (r < r*), 
the notation "Y = X(*,[l :c])" means that Y consists of as many copies of X as needed 
to fill the r* rows of Y. It should be appreciated that the last copy could be partial, if r 
does not divide r'. For example, if r' = 2.5r then the notation would mean that: 

Y([l :r],[l :c]) = Y([r+l :2r],[l :c]) = X,and 

Y([2r + 1 : 2.5r], [1 : c]) = X([ 1 : 0.5r], [1 : c]). 
The larger problem M'x' = b* of size n'> n is defined as follows. The matrix 
M' and vector b' are defined as follows, where: the matrices O* and O" are of 
dimension n x (n* - n) and (n* - n) x n, respectively, all of whose entries are zero; S' is 
an (n* - n) x (n* - n) random invertible matrix, and y is a random vector of length n -n: 

M'([l :n],[l :n]) = M; 
' . M'([l :n],[n+ 1 :n']) = 0'; 

M'([n + 1 : n'],[l : n]) = O"; 

M'([n+ 1 :n'],[n+ 1 :n]) = S'; 

b'([l :n]) = b;and 

b'([n + 1 : n']) = S'y. 
Then the solution x' to the system M'x* = b* is x* ([1 : n]) = x and x' ([n + 1, n*]) = y. 
Note that the zero entries of O' and O" do not betray n because these zeroes are hidden 
when C = P1MP2 ~' is computed. As an alternative, matrices O' and O" need not have 
zeroes if: 
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a. O' is a random matrix (rather than a matrix of zeros); 

b. 0" = M(*,[l:n]); 

c. S' = OX*, [n + 1 : n*]); and 

d. b' = (b + 0'y)(*). 

If the selection of random values for y and matrix O' result in a noninvertible M', then 
the corresponding operations are repeated until an invertible M' results.. For an 
invertible M*, the solutions x' to the system M*x' = b' remains x'([l : n]) = x and x' ([n 
+ 1 , n*]) = y because Mx + O'y = b'([ 1 : n]) = b + 0*y and hence Mx = b. 



EXAMPLE TEN 

A tenth example is provided as disguise procedure DP 10 for a secure 
quadrature computation to be outsourced. For DP 10, the objective is to provide an 
estimate corresponding to the following expression (27): 

b 

J f(x)dx (27) 

a 

witH accuracy designated as "eps". Expression (27) correspond^ to the actual 
arguments AA to be disguised by DP 10. DP 10 proceeds in accordance with stages 
a.-e. as follows: 

a. Subsystem 30 chooses Xi = a, x? - b and 5 ordered, random 
numbers Xi in [a,b] and 7 values Vj with a range defined such that min | f(x) | 
« Ml M2 « max I f(x) | ; where Mi and M2 are estimations and the 
operators min | f(x) | and max | f(x) | return the minimum and maximum 
value of f(x), respectively. 
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b. Subsystem 30 creates a cubic spline g(x) ^yith breakpoints Xj such 
that g(xi) = Vi . 

c. Subsystem 30 integrates g(x) from a to b to obtain Ii and sends 
g(x)+f(x) (the disguised arguments DA) and eps to computing center 50 for 

5 numerical quadrature. 

d. Computing center 50 retums I2 (the disguised result DR) to 
subsystem 30. 

e. Subsystem 30 computes I2 - Ii which is the actual answer SA. 

EXAMPLE ELEVEN 
In an eleventh example, a disguise procedure DPI 1 for quadrature 
computations is provided that is more robust with respect to an approximation 
theoretic attack. DPI 1 modifies DP 10 to add a second disguise fiinction. 
Specifically, to assure that f(x) has a smoothness characteristic comparable to g(x). 
Further security enhancements may optionally be incorporated by using reverse 
conimunic3,tion as described in J.R. Rice, Numerical Methods. Software, and 
Analysis . 2d ed., Academic Press (1993), which is hereby incorporated by reference 
in its entirety, or by replacing f(x) with a high accuracy approximation as previously 
discussed in connection with random fimction determinations. 

EXAMPLE TWELVE 
In a twelfth example, disguise procedure DP 12 provides for secure 
outsourcing of a convolution computation of two vectors Mi and M2 of size n, 
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indexed from 0 to n - 1 (the actual arguments AA). It should be appreciated that the 
convolution M, of Mi and M2, is a new vector of the size 2n - 1, denoted by 
M = M| ® M2, such that expression (28) follows: 

roin(t,n— 1) 

M(0= y\ Mi(k)M2ii-k). (28) 

DP 12 includes the following stages a.-f.: 

a. Subsystem 30 randomly selects vectors Si, S2, of size n and five 
positive numbers a, p, 7, p*, y* such that: (p + ayXp' + aY')(Y'p - yp') ^ 0. 

b. Subsystem 30 computes six vectors: aMi + Si, aMa + S2. 
pMi - ySi, PM2 - yS2. P'Mi — y'Si, p'M2 .+ y'Sz. 

c. Subsystem 30 outsources to compiiting center 50 the three 
convolutions defined by expressions (29)-(31) that follow: 

W = (aMi-hSi) ®(aM2 + S2); (29) 
U = ( pMi - ySi) ® ( PM2 - yS2 ); and (30) 
U' = (p'M, -y'Sl) ®(p'M2-y'S2). (31) 

d. Computing center 50 returns W, U, and U' to subsystem 30 as the 
disguised results DR. 

e. Subsystem 30 computes the vectors according to expressions (32) 
and (33) as follows: 

V = (p + ay)-*(aU + pyW) (32) 
V* = ( p' + ay')"' ( aU' + p>'W ) (33) 

where it may be observed that V = aPMi ® M2 + ySi ® S2, and 

V' = aP'Mi®M2+ ySi®S2. 
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f. Subsystem 30 computes a"^ ( 7'P - yP' ) ( y' V - yV ), which 
equals the actual answer SA, Mi ® M2 . 



m 



Further, security of an outsourced convolution computation may be enhanced 
5 by hiding the dimension. The dimension may be expanded for a convolution 
computatipn by "padding" the two input vectors with zeroes. The zeroes do not 
betray the value of n because they are hidden through the addition of random 
numbers. Alternatively or additionally, the dimension may be hidden by shrinking the 
problem size with two operations: (a) replacing the convolution size n by three 
10 convolutions of size n/2 each, and then (b) recursively hiding (by shrinking or 
expanding) the sizes of these three convolutions with a recursion depth of 0(J). 

EXAMPLE THIRTEEN 
In a thirteenth example, disguise procedure DP 13 provides for secure 
1 5 outsourcing of the solution to a differential equation defined as a two point boundary 
value problem in expressions (34)-(36) that follow: 

y" + ai(x)y' + a2(x)y = f(x,y); (34) 
y(a) = yo; and (35) 

y(b) = yi. (36) 

20 The differential equation of expression (34) and the boundary conditions of 

expressions (35) and (36) are the actual arguments SA for DPI 3. DP13 proceeds in 
accordance with stages a.- d. as follows: 

a. Subsystem 30 selects a cubic spline g(x) and creates the function of 
expression (37) that follows: 

44 



4-48409/7024-395 




u(x) = g" + a,(x)g' + a2(x)g. (37) 

b. Subsystem 30 sends the problem defined by the following 
expressions (38)-(40) as disguised arguments DA to computing center 50 for 
solution: 

y" + ai(x)y + a2(x)y = f(x,y) + u(x); (38) 
y(a) = yo+ u(a); and (39) 
y(b) = yi+u(b). (40) 

c. Computing center 50 solves the problem corresponding to 
expressions (38)-(40) and returns z(x), the disguised result DR, to subsystem 
30. 

d. Subsystem 30 computes the actual answer, z(x) — g(x). 

EXAMPLE FOURTEEN 
The outsourcing of computations may involve the transmission of a substantial 
amoimt of symbolic input, either pure mathematical expressions or high level 
programming language (Fortran, C, etc.) code. Such code can compromise security if 
provided without a disguise during outsourcing. Disguise procedure DP 14 of this 
foiuteenth example describes various techniques to disguise symbolic information and 
to address security risks posed by "symbolic code analysis" attacks. Various 
operations that may be alternatively or collectively performed in accordance with 
DP 14 include: 

(a) reducing or eliminating all name information in the code, including 
the deletion of all comments and/or removal of all information firom variable 
names; 
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(b) utilizing approximations of basic mathematical functions, such as 
sine, cosine, logarithm, absolute value, exponentiation, to reduce the 
likelihood such functions can be readily identified by code inspection 
(techniques may include, for example, one time elementary function 
approximations for these functions using a combination of a few random 
paijameters along with best piecewise polynomial, variable breakpoint 
approximations) ; 

(c) applying symbolic transformations such as changes of coordinates, 
changes of basis functions or representations, and use of identities and 
expansions of xmity; and/or 

(d) utilizing reverse communication to avoid peissing source code for 
numerical computations to agent A and to hide parts of the original 
computation. 

In one instance of reverse communication according to this example, it may be 
desirable to avoid passing the code for the function u(x) to computing center 50; 
however, computing center 50 may be selected to do computations to provide x before 
u(x) needs to be determined, and further computing center 50 may selected to perform 
computations involving u(x) after u(x) is made available. Accordingly, subsystem 30 
receives x from computing center 50, evaluates u(x), and returns u(x) to computing 
center 50 for further processing in accordance with this reverse communication 
embodiment. 

In one instance of symbolic transformation according to this example, the 
readily recognizable differential equation given by expression (41) as follows: 

46 



4-48409/7024-395 




+ x*cos(x)y' + (x^ + log(x))y = 1 + x^ (41) 
is disguised by applying the following symbolic transformations defined by 
expressions (42)-(47) that follow: 

cos^x - sin^y = cos(x + y) cos(x - y); (42) 
sec^(x + y) - tan^(x + y) = 1 ; (43) 
I (tanx + tany) / tan (x + y) + tan x tan y = 1 ; (44) 
1 +x = ( l-x^)/(x-x); (45) 
sin(3(x+ y)) = 3sin(x + y) - 4sin^(x + y); and (46) 
a^ - ax + x^ = (a^ + x^) / (a + x). (47) 
By rearranging and renaming, a more complicated result may be obtained as 



represented by expression (48); where the Greek letters are various constants that 
have been generated: 

(pcos^x - 5) y" + x[cosx/(ycos(x+1)) - cosx sin(x +1) tan (x + 1)]* 

[e- sin^x + e sin(x +1) — sin^xsin(x+l)]y' 

+ [p(xcosx)^ — T|(x + logx) + Gcosx log(x^)]* 

[r| sinx + S tanx + [xsinx + ^cosx + v) / tan (x -H 2)] y 

= ( 1 + x^)[sinx + Ticosx] (48) 

Moreover, by further renaming and implementation of some elementary functions, 
including the replacement of the variable names by the order in which the variables 
appear, expression (48) is becomes expression (49) as follows: 

y ' ' [xO 1 * x02(x) - x03] (49) 
+ y' [x04 * X / (x05 cos(x + 1) + cosx * x06(x) tan(x +1)]* 

[x07 - sin\- x08(x)sin^ + x07sin^(x + 1)] 
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+ y[x01 * (x * x09(x))^ - xlO(x -f logx) + xl Icosxlogx^]* 

[xl2 * xl3(x) + xl4tanx + xlSsinx + xl6cosx + xl7)] 
= sinx + xl8 * (1 + x^) * x09(x) + xl9(x) + xlO*x^cosx. 

EXAMPLE FIFTEEN 
In example fifteen, disguise procedure DP 15 is applied to enhance security of 
an outsourced computation for detecting edges of an image represented by an n x n 
array of pixel values p(x,y) between 0 and 100,000 on the square 0 < x,y <_ 1. DP 15 
includes the following stages a.- f: 

a. Subsystem 30 sets xi,yi = 0, xio,yio = 1, and selects: two sets of 8 
ordered, random numbers with 0 < Xi,yi < 1; 100 random values 0 < Vjj < 
50,000; and, 4 pairs (ai,bi) of positive, random numbers with ai = min(ai), 
a4 = max(ai)), bi = min(bi), b4 = max(bi). 

b. Subsystem 30 establishes the bi-cubic spline s(x,y) so that 
s(xi,yO = Vij. 

c. Subsystem 30 determines the linear change of coordinates from 
(x,y) to (u,v) that maps the unit square into the rectangle with vertices (ai,bi). 

d. Subsystem 30 sends p(u(x,y), v(x,y)) + s(u(x,y), v(x,y)) as disguised 
arguments DA to computing center 50 to perform an edge detection 
computation. 

e. Computing center 50 generates the disguised result DR as an image 
e(u,v) showing the edges and returns e(u,v) to subsystem 30. 

f Subsystem 30 computes e(x(u,v), y(u,v)) to obtain actual answer 
SA, the desired edges. 
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EXAMPLE SIXTEEN 
For example sixteen, secure outsourcing of template matching utilized for 
image analysis is provided by disguise procedure DP 16. For an N x N image I and a 
smaller n x n image object P, consider the computation ofan(N-n+l)x(N-n-»- 
1) score matrix Ci,p of the form given by expression (50) as follows: 

n-l n-1 

CiAiJ)==J2Ylfini-^kJ + k%P{{k,k')), 0<»,i</sr-n, (50) 

Jb=0 if =0 

for some function f. Score matrices are often used in image analysis, specifically in 
template matching, when one is trying to determine whether (and where) an object 
occurs in an image. A small Ci,p(i J) indicates an approximate occurrence of the 
image object P in the image I (a zero indicates an exact occurrence). Frequent choices 
for the function f are f(x,y) = (x - y)^ and f(x,y) = |x - y|. 

When the function f( x,y ) = ( x - y )^ is selected, DP 16 proceeds with stages 
a.-e. as follows: 

a. Subsystem 30 selects a random N x N matrix SI, and a random n x 
n matrix S2; and generates five positive random numbers a, p, y, p', y' such 
that (p + ay)(p' + ay')(y'p - yp') ^ 0. 

b. Subsystem 30 computes six matrices: aH- SI, aP + S2, pi -ySl, pP 
-^S2^ pi ^'S 1 . pT -7*S2, that serve as disguised arguments DA. 

c. Subsystem 30 outsources the computation of three score matrices 
Cx.y, to computing center 50; where there is one score matrix for each pair X,Y 
of the matrices received. 
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d. Computing center 50 calculates the matrices and returns them to 
subsystem 30 as defined by the following expressions (51)-(53): 

W = C(aI + Sl),(aP + S2) (51) 

U = C(pi - yS 1 )(PP - yS2) (52) 

U' = C(p'|-Y'SI)(p'P-y»S2) (53) 

I e. Subsystem 30 computes the matrices V and V from W, U, and U' 
(the disguised results DR) as retumed by computing center 50. The 
determination of matrices V and V are in accordance with expressions (54)- 
(55) as follows: 

V = (P + ay) (aU + pyW); and (54) 

V = (P' + ay') (aU' + p'y' W). (55) 
Subsystem 30 computes a "*(y'p - yp') (y' V - yV) from V and V which 
equals Ci,p. 

When the function f( x,y ) = |x - y| is selected, DP 16 proceeds with a two- 
dimensional version of the convolution disguise procedure, DP12; where A is defined 
as an alphabet, i.e., the set of symbols that appear in I or P; and for every symbol x 
e A, DP 16 proceeds with the following stages a.- h.: 

a. Subsystem 30 replaces, in I, every symbol other than x by 0 (every 
x in I stays the same); where Ix is designated the resulting image. 

b. Subsystem 30 replaces every symbol that is < x by 1 in P, and 
replaces every other symbol by 0; where Px is designated as the resulting 
image. Px is augmented into an N x N matrix n x by padding it with zeroes 
which serves a first group of the disguised arguments DA. 
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c. Subsystem 30 outsources the computation of the score matrix 
according to the following expression (56) to computing center 50: 

D^iJ) = E E + + fc')nx(A:, k'), 0<iJ<N^ n. ^^^^ 

5 

Expression (55) is a form of 2-dimensional convolution that can be outsourced 
using DP 12. 

d. Subsystem 30 replaces, in P, every symbol other than x by 0 (every 
x in P stays the same); where Px* is designated as the resulting image. Px' is 

1 0 augmented into an N x N matrix FI x* by padding it with zeroes which serves 

as second group of the disguised arguments (DA), 
ryl e. Subsystem 30 replaces every symbol that is < x by 1 in I, and every 

□ other symbol by 0; where Ix' is designated the resulting image. 

Q f. Subsystem 30 outsources the computation of the score matrix 

15 according to the following expression (57) to computing center 50: 



n-ln-l 

D'AiJ) = E E + + *')nx(*^. k'), 0<iJ<N- n. (57) 
k=0 



Expression (56) is a form of 2-dimensional convolution that can be outsourced 
20 using DP 12. 

g. Computing center 50 retiuns the computations corresponding to 
expressions (56) and (57) (the disguised results DR) to subsystem 30. 

h. Subsystem 30 computes the actual answer SA in accordance with 
expression (58) as follows: 
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c,.P = Z(Dx + Dx) 



(58) 



EXAMPLE SEVENTEEN 



In example seventeen, a secure outsourcing technique for sorting a sequence 
of numbers E = {ei,. . Cn} is provided as disguise procedure DP 17. DP17 proceeds 



with stages a.- f. as follows: 

a. Subsystem 30 selects a strictly increasing function f : E — ► R, such 
as f(x) = a + p( x47 where p > 0. For this function f(x), subsystem 30 
selects a, P, and y in accordance with p > 0. 

b. Subsystem 30 generates a random sorted sequence A = {Xi, „.,X/} of 
/ numbers by randomly "walking" on the real line from MIN to MAX where 
MIN is smaller than the smallest number in E and MAX is larger than the 
largest number in E. Letting A = (MAX — MIN)/n, the random walking is 
implemented by subsystem 30 as follows: (i) randomly generate X\ from a 
uniform distribution in [MIN,MIN + 2A]; (ii) randomly generate X2 from a 
uniform distribution in [Xi, Xi + 2 A ]; and continue in the same way until 
MAX is exceeded, which provides a total number of elements /. It may be 
observed that A is sorted by the construction such that the expected value for 
the increment is A. Correspondingly, the expected value for / is given by: 
(MAX-MIN)/A = n. 

c. Subsystem 30 computes the sequences E* — f(E) £md A' = f(A); 
where f(E) is the sequence obtained from E by replacing every element ej by 
f(ei), and concatenates the sequence A' to E', obtaining W = E* u A'. 
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d. Subsystem 30 randomly pemiutes W, the disguised arguments DA, 
before outsourcing to computing center 50. 

e. Computing center 50 returns the disguised arguments DA as sorted 
result W. 

f. Subsystem 30 removes A* from W * to produce the sorted sequence 
E' ^and computes E = f'^(E'), the actual answer S A. 

The value n may be revealed by this approach, because the number of items 
sent to the agent has expected value 2n. To provide greater security, n may be 
modified by letting A = (MAX - MIN) / m where m is a number independent of n. 
Therefore the size of the outsourced sequence is m + n, which hides the size of 
problem through expansion. 



Li example 1 8, secure outsourcing of a text string pattern matching 
computation is provided by disguise procedure DPI 8. For DPI 8, T is a text string of 
length N, P is a pattern of length n (n < N), and both are over alphabet A. DP 18 is 
based on establishing a score vector Ct,p such that CT,p(i) is the number of positions at 
which the symbols of pattern P equal their corresponding symbols of text string T 
when the pattern P is positioned under the substring of T that begins at position i of T, 
such that it is in accordance with the following expression (59): 



EXAMPLE EIGHTEEN 



2-A:=0 ^(ib+t)./>(0 



(59) 



where 8x,y equals one if x = y and zero otherwise. 
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DPI 8 performs the following stages a.-d. for every symbol x e A: 

a. Subsystem 30 replaces, in both T and P, every symbol other than x by 0, 
and every x by 1 ; and lets Tx and Px be the resulting text and pattern, respectively. Px 
is augmented into a length N string FI x by padding it with zeros. 

b. Subsystem 30 outsources to computing center 50 the computation of 
expression (60) as follows: 

^^^^D^(<r=^^ 0<T^ir^^ — ~_i60) 

k=0 

The terms of expression (60) (disguised arguments DA) define a form of 
convolution that may be securely outsourced using DP 12. 

c. Computing center 50 returns disguised result DR, the expression (60) 
computation, to subsystem 30, 

d. Subsystem 30 determines the actual answer SA, the score matrix Ct,p as: 
ZxGaDx. 

It should be appreciated that examples 1-1 8 are but a few of the forms of the 
embodiments of the present invention that may be utilized to provide secure 
outsourcing of one or more computations. Indeed, the stages, operations and 
techniques of these examples may be rearranged, combined, separated, deleted, 
altered, and added to other stages, operations, or techniques as would occur to those 
skilled in the art. 

Further, in one alternative embodiment of the present invention, a system 
dedicated to the performance of only a single type of disguise procedure is utilized. 
In another alternative, different types of outsourced computations may be 
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accommodated by a single disguise procedure or protocol. It should be appreciated 
that classification of the outsourced computation type for these alternative 
embodiments is optional. Indeed, even when selection of a disguise procedure is 
based on outsourced computation type, computation classification with one or more 
programs or computers is not needed; where, for example, an operator selects an 
appropriatp disguise procedure for a given outsourced computation. In .still other 
embodiments, classification may be partially operator-based or fiiUy performed 
through the execution of one or more programs or routines. 

Also, it should be appreciated that multiple agents A may be utilized to 
perform different parts of a given outsourced computation. Moreover, outsourced 
computation results may be received by a different computer than the sending 
computer. For this example, the different computers of customer C may exchange 
information desired to recover actual answer SA. In still other embodiments, multiple 
sites or computers may be utilized to prepare the disguised arguments DA and/or 
receive the disguised result DR. 

Also, while both disguised arguments DA and disguised result DR are 
preferred, in other embodiments, it may be acceptable to reveal at least some of the 
actual arguments with only the result being disguised or to receive the actual answer 
with only the argimients being disguised. Further, while the term "arguments" has 
been used in the plural, it should be appreciated that the present invention includes 
embodiments that have only one argument. Correspondingly, while disguised result 
DR and actual answer SA have been used in the singulai", it should be appreciated that 
the disguised result and/or actual answer may refer to a plurality. 

Yet another embodiment of the present invention includes: determining one 
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or more arguments to be outsourced; disguising the arguments by performing a local 
computation with a first computer; sending the disguised arguments to a second 
computer to perform the outsourced computation; and receiving a result of the 
outsourced computation. 

Still another embodiment of the present invention includes a computer, an 
output deyice, and an input device. The computer is uniquely programmed to 
determine a group of disguised arguments from a set of actual arguments. The 
disguised arguments hide one or more characteristics of the actual arguments. The 
disguised arguments are output by the output device for remote performance of the 
outsourced computation. The input device receives the result of the outsourced 
computation performed with the disguised arguments. 

A further embodiment of the present invention includes operating a first 
computer in accordance with one or more instructions to perform an outsourced 
mathematical operation. The first computer having received a number of disguised 
arguments that hide a group of actual arguments for the outsourced mathematical 
operation. The outsourced mathematical operation is performed on the disguised 
arguments with the first computer, and the result of the outsourced mathematical 
operation is output by the first computer. 

In another embodiment, a system includes an input device to receive a 
plurality of disguised arguments that hide at least one characteristic of each of a 
number of actual arguments. The system also includes a computer responsive to the 
input device to perform an outsourced computation with the disguised arguments and 
provide a result of the outsourced computation. The system further comprises an 
output device to output the result for conversion to an actual answer corresponding to 
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the actual arguments. 

Still a further embodiment includes a computer readable medium that defines 
computer programming instructions to hide a group of actual arguments for a 
computation to be outsourced. The instructions provide for the generation of a group 
of disguised arguments corresponding to the actual arguments. The disguised 
arguments^ are generated to provide a disguised result when provided for the 
computation. An actual answer is recoverable from the disguised result in accordance 
with the instructions. The actual answer corresponds to the results returned by the 
computation when the computation is provided the actual arguments. 

All publications, patents, and patent applications cited in this specification are 
herein incorporated by reference as if each individual publication, patent, or patent 
application were specifically and individually indicated to be incorporated by 
reference and set forth in its entirety herein. While the invention has been illustrated 
and described in detail in the drawings and foregoing description, the same is to be 
considered as illustrative and not restrictive in character, it being imderstood that only 
the preferred embodiment has been shovm and described and that all changes, 
equivalents, and modifications that come within the spirit of the inventions defined by 
following claims are desired to be protected. 
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